How to Backup Data on Windows 11: A Step-by-Step Guide

Prerequisites and What You Need Before You Start

Backing up Windows 11 requires a repeatable process that protects critical files against device corruption, accidental deletion, and malware infections. By the end of this tutorial, you will have configured automated versioned file backups using Windows 11 File History, created an offline system image for bare-metal restoration, and scheduled a testing routine to verify that your business records are recoverable.

Before beginning, prepare an external storage drive formatted with the NTFS file system. Choose an external drive with at least twice the storage capacity of the internal drive on your Windows 11 computer. You also need local administrator rights on the endpoint to configure system-level recovery tools and format external media. If your business manages endpoints centrally, ensure group policies permit local external volume writes for backup purposes.

A reliable data retention routine forms the baseline of any defensive strategy. The NCSC Small Business Guide emphasizes that regular data backups save time, money, and operational reputation when workstations fail or suffer attacks. Establishing automated local and decoupled storage ensures that your operational baseline survives severe operating system crashes or targeted tampering.

Selecting Your Windows 11 Backup Strategy

Small businesses face distinct threats ranging from SSD failures to ransomware. In its publication on stopping malware threats, CISA StopRansomware guidance notes that ransomware encrypts files to render operational devices unusable, making offline, encrypted backups an essential defensive countermeasure. Relying solely on real-time cloud synchronization folders is insufficient because ransomware can sync encrypted payloads directly to the cloud container.

A resilient strategy blends continuous local file versioning with periodic offline image capture. File History handles hourly changes across Desktop, Documents, and active work folders. System images preserve operating system settings, user registries, and installed business utilities. You should track these data assets and their recovery priorities inside an operational cyber risk register to determine acceptable data loss windows across your fleet.

Tier 1 (User Files): Windows File History -> Hourly to dedicated local drive
Tier 2 (System State): Windows System Image -> Monthly to offline external drive
Tier 3 (Enterprise Sync): OneDrive / Cloud Storage -> Continuous for offsite availability
Tier 4 (Cold Storage): Air-gapped physical disk -> Weekly or monthly disconnected vault

Configuring File History for Continuous Document Protection

Windows 11 retains the classic File History utility, which monitors your selected user libraries and saves previous versions of changed records. Connect your dedicated external drive to the computer. Open the Start menu, type Control Panel, and select File History. If Windows does not automatically detect the external device, click Select drive in the left navigation panel, highlight your target volume, and select OK.

Click Advanced settings in the left pane to determine snapshot frequencies and retention policies. The default setting saves copies of files every hour, which works well for active office workloads. In the Keep saved versions dropdown, choose a retention window that balances storage space against compliance needs, such as Until space is needed or 1 year. Click Save changes, return to the main File History window, and click Turn on to initiate your baseline backup snapshot.

Creating a Complete Windows 11 System Image

While File History protects user folders, it does not preserve the underlying operating system installation, device drivers, or custom business software configurations. A System Image creates an exact sector-by-sector clone of your Windows 11 drives. To create one, open the Control Panel and select Backup and Restore (Windows 7), which remains supported in Windows 11 for legacy image creation.

Select Create a system image from the left panel. Choose On a hard disk, pick your connected external drive, and click Next. Windows automatically selects the EFI System Partition, the C: system volume, and the Windows Recovery Environment. Confirm your settings and click Start backup. Depending on your total data volume and drive interface speed, this process will take anywhere from twenty minutes to several hours. Store this image safely to avoid reconfiguring machines from scratch during system replacements.

Applying Ransomware Isolation and Drive Encryption

A backup accessible via an active drive letter remains vulnerable to automated malware scripts. Defending your data requires decoupling the physical storage medium immediately after backup operations complete. Once File History or System Image creation completes, safely eject the external drive using the taskbar notification tray and physically disconnect the USB cable. Store the disconnected disk in a secure, fire-resistant location.

To protect confidential business data stored on the backup disk if the physical device is lost or stolen, turn on BitLocker Drive Encryption on the external storage drive. Open File Explorer, right-click the backup drive, and select Turn on BitLocker. Choose a complex password or export a digital recovery key to secure administrative storage. Windows 11 will encrypt existing data on the drive and protect all subsequent backup files written to it.

Monitoring unauthorized access attempts and connection events on endpoints helps detect attempts to tamper with data. Blue teams track storage volume mount activities and script execution by evaluating Windows security event IDs inside system telemetry to catch lateral movement early.

Testing Backup Integrity and Restoration

A backup that has never been tested is not a reliable security control. IT leads must schedule routine restoration drills to prove that backup archives are readable and uncorrupted. To test File History, navigate to a directory containing active records, right-click an arbitrary file, and select Restore previous versions from the context menu. Inspect the list of timestamps, choose a previous point in time, and restore the file to an alternate temporary path to confirm file contents open without errors.

To verify system images, create a Windows Recovery USB drive using the Recovery Drive app in Windows 11. Boot a non-production test workstation or test virtual machine from the recovery media, select Troubleshoot, choose Advanced Options, and select System Image Recovery. Confirm that the recovery environment identifies the external drive, reads the system catalog, and displays the correct snapshot timestamp without read failures.

Incorporating Windows Backups into Incident Response Plans

Data backups are only as useful as the recovery procedures surrounding them. The NIST SP 800-61 Rev. 3 incident response recommendations focus on incorporating cybersecurity incident response into broader organizational risk management, highlighting recovery efficiency as a core priority. Document exactly who holds access to the physical backup drives, how often images are captured, and the expected recovery time objective for critical workstations.

Include these steps directly inside your operational incident response plan. Define a clear rule: if an endpoint displays signs of compromise, isolate the system from the network immediately before attempting any data recovery. Restoring a clean backup onto an active, uncontained malware infection risks destroying the restored files and corrupting the connected backup disk.